move subscribe to its own controller, add authorization, test subscribe/unsubscribe
change to authenticate_user
Merge pull request #525 from differentreality/subscribe

Subscribe option: move to its own controller, add authorization